Re: [OAUTH-WG] Issue 15, new client registration

2.1 Client types

I'm struggeling with the new terminology of "private" and "public" 
clients. In my perception, the text just distinguishes clients which can 
be authenticated and such which cannot. This is fine but I consider the 
wording misleading. I would suggest to change it to something like 
trusted/untrusted or authenticated/unauthenticated or Verifiable/Forgeable.

Moreover, I think merging the text on client types in section 10 into 
section 2.1 would make sense for the following reasons:
- there is large overlap between them
- It would introduce the term "native application" before it is used for 
the first time in Section 9

2.2. Registration Requirements

Why is the redirect URI a MUST? It should be a MUST for clients using 
the implicit grant and probably for "private" clients but why generally? 
I would suggest to change this to RECOMMENDED.

2.4 Client Authentication

"In addition, the client and authorization server establish a client
    authentication method suitable for the client type and security
    requirements of the authorization server."

Does this hold true for public clients?

2.4.1 Client Password

"Clients in possession of a client password MAY " Why not SHOULD?

regards,
Torsten.

Am 20.07.2011 22:56, schrieb Torsten Lodderstedt:
> 2.1 Client types
>
> I'm struggeling with the new terminology of "private" and "public" 
> clients. In my perception, the text just distinguishes clients which 
> can be authenticated and such which cannot. This is fine but I 
> consider the wording misleading. I would suggest to change it to 
> something like trusted/untrusted or authenticated/unauthenticated or 
> Verifiable/Forgeable.
>
> Moreover, I think merging section 2.1 with the text on client types in 
> section 10 would make sense for the following reasons:
> - there is large overlap between them
> - It would introduce the term "native application" before it is used 
> for the first time in Section 9
>
> 2.2. Registration Requirements
>
> Why is the redirect URI a MUST? It should be a MUST for clients using 
> the implicit grant and probably for "private" clients but why 
> generally? I would suggest to change this to RECOMMENDED.
>
> 2.4 Client Authentication
>
> "In addition, the client and authorization server establish a client
>    authentication method suitable for the client type and security
>    requirements of the authorization server."
>
> Does this hold true for public clients?
>
> 2.4.1 Client Password
>
> ""
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth